use local authelia socket for auth subrequests - #3
Open
cyberb wants to merge 1 commit into
Open
Conversation
The auth subrequest proxied to the public auth URL, which nginx resolves once at config load and then caches for the lifetime of the process. On a device with a dynamic prefix the cached address goes stale and every request to the app hangs on proxy_connect_timeout before failing the subrequest, surfacing as a 500. GetAuthLocalSocket returns a fixed local path, so there is no name to resolve and no cache to go stale. Same fix owntracks got in 8089a34; it reached every app packaged after it, but the ones that already existed were never back-ported. Confirmed in the field on transmission, whose nginx had held a dead address for five months after the ISP rotated the IPv6 /64. No golib bump needed here, already on v1.1.22.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Back-port of the auth-socket fix. Companion to syncloud/transmission#1, where this bug was caught in the field.
config/authelia-location.confproxies/internal/authelia/authzto the public auth URL. nginx resolves a literal hostname inproxy_passonce at config load and caches it for the process lifetime — it never re-resolves. On a device with a dynamic prefix the cached address goes stale and every request hangs onproxy_connect_timeoutbefore failing the subrequest, surfacing as a 500.Switching to
GetAuthLocalSocket()— a fixed local socket path — removes the name to resolve and the cache to go stale.Why now
This is the same fix owntracks got in
8089a34(2026-04-16). It propagated to every app packaged after it, but the three that already existed were never back-ported. Transmission hit it for real: its nginx had held a dead address for five months after the ISP rotated the IPv6/64.Worth noting for this repo specifically: youtube was last touched 2026-08-24 and still went in on the old pattern. So this is not just old apps drifting — the current pattern was not reaching new work either.
Validation
Verified end-to-end on transmission, not on youtube — the code change here is identical, but the runtime confirmation came from the app that was actually broken:
500302to login0.53sHere:
go build,go vetandgofmtclean. Leaving real verification to CI.Notes for review
GetAuthLocalSocket.AuthAddressis kept: it is still referenced by the commented-out legacy redirect inconfig/authelia-authrequest.conf:32, and Go templates render inside#comments, so removing the field would break generation.